CancelDll
LoadDll
Behavioral task
behavioral1
Sample
2e043491b07e52dec76f442ec4f3de50_JaffaCakes118.dll
Resource
win7-20240903-en
Target
2e043491b07e52dec76f442ec4f3de50_JaffaCakes118
Size
61KB
MD5
2e043491b07e52dec76f442ec4f3de50
SHA1
208cf4536919de7d5885088f4cf04929b2f57b30
SHA256
8fa9c9cb355bee54bc2017414ff15c8439fb343351b871ee662b9c432ff2cda3
SHA512
dacdffaf7d79f71fe306f535631679ed8e20e824e6f80649bf53dd10ccb1f3eb56c2f22feeba52ebe3f8ca0fd98ee87b5afd003ba88b45d206dcfb196be32f22
SSDEEP
1536:NomNZnI+CQSrNl7x9WD4v7rYQyNLgDRss+LRV:NooC+CB7nWDYcQyLyRspz
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
2e043491b07e52dec76f442ec4f3de50_JaffaCakes118 |
unpack001/out.upx |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
CancelDll
LoadDll
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ